Malware Analysis Report

2025-08-05 15:09

Sample ID 250503-sc7yfaxls4
Target 2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
SHA256 f032af7f19f6f8271d9ebfbd15c5dcaebc93ec5f2b155c30429363e1c887dcae
Tags
gofing credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f032af7f19f6f8271d9ebfbd15c5dcaebc93ec5f2b155c30429363e1c887dcae

Threat Level: Known bad

The file 2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing credential_access discovery ransomware spyware stealer

Gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Gofing family

Renames multiple (51) files with added filename extension

Drops file in Drivers directory

Manipulates Digital Signatures

Drops startup file

Executes dropped EXE

Credentials from Password Stores: Windows Credential Manager

Loads dropped DLL

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Drops Chrome extension

Drops autorun.inf file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Browser Information Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-03 14:59

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-03 14:59

Reported

2025-05-03 15:02

Platform

win11-20250502-en

Max time kernel

150s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (51) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\hidserv.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-IntegrationComponents-VirtualDevice-Server-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Microsoft.Internal.FrameworkUdk.System.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\twext.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Microsoft.Uev.AppAgent.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA435_olpc_LE_3.bin C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\tasklist.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\it-IT\lipeula.rtf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~~10.0.22000.282.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package041820~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Provisioning-Platform-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.51.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMIEvents-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\PSEvents.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_3338930aa7b8a71f\mdmgl008.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-System-AzureVirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.22000.434.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Client-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\F12\es-ES\F12Script.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Storage-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MultiPoint-Connector-Opt-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DeviceDirectoryClient.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_de0a77e7d10806be\mdmsun1.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ErrorReporting-Adm-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\Dism\es-ES\DmiProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AcXtrnal.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\kbdlk41a.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\useractivitybroker.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\C_869.NLS C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\TempSignedLicenseExchangeTask.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-DisposableClientVM-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Casting-Platform-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.376.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Enterprise-Desktop-Shared-WOW64-Package~31bf3856ad364e35~amd64~~10.0.22000.132.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDUK.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\diagnosticdataquery.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\fr-FR\WinSATAPI.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ja-JP\EventViewer_EventDetails.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Network-Security-MPSSVC-Package~31bf3856ad364e35~amd64~~10.0.22000.318.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\es-ES\netttcim.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ConfigCI-Onecore-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA435_olpc_LE_15.bin C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\aadauthhelper.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-WFS-FoD-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\es-ES\adsldpc.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\fr-FR\netttcim.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_46a68184927df9e8\disk.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_84ea762c0a90c362\pciide.sys C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA435_olpc.bin C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\p2p-mesh.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\ComputerDefaults.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.22000.434.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.22000.493.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EditionSpecific-Professional-Package~31bf3856ad364e35~amd64~~10.0.22000.493.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RecDisc-SDP-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CheckNetIsolation.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Devices-LowLevel-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-mmc-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_printer.inf_amd64_32adf57db4d63f28\c_printer.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_46fb5b718b259171\mdmmcd.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Biometrics-Package~31bf3856ad364e35~amd64~~10.0.22000.100.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.ELM C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\ExploreModel.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\3.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\MSFT_PackageManagementSource.psm1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\am.pak C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.SPClient.Interfaces.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\KeytipData.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\TextField.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\SplitSend.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsSmallTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-lightunplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\hr.pak C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-80_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Mozilla Firefox\platform.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-hover_32.svg C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare310x310Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.TerminalControl\TSFInputControl.xaml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\createpdf.svg C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsSplashScreen.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorStoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\object.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CORPerfMonExt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\de-DE\EncryptFilesonMove.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.Design.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\Biometrics.admx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\M1033Zira.keyboard.RAD C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\cross_il.cur C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\WINGDNG3.TTF C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ApplicationConfigurationPage.cs C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web_minimaltrust.config C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.RunTime.Serialization.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\WindowsFirewall.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\M1033Eva.voiceAssistant.UNT C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\EFI\kd_02_1af4.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\caspol.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAuthentication.ascx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\EventViewer.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netvwifimp.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Http.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\Resources\en-US\bootres.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\up_i.cur C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Runtime.WindowsRuntime.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Runtime.WindowsRuntime.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\v4.0_1.0.0.0_it_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.WindowsSearch.Commands.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\es-ES\StorageSense.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\managePermissions.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAuthentication.ascx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ja\System.Printing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\Microsoft.JScript.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.Reflection.Context.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\EFI\ko-KR\bootmgr.efi.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mtconfig.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageconsolidatedProviders.aspx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Process\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Process.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\System.ServiceModel.Web.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\PreviousVersions.admx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\en-US\Multitasking.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\Windows.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmarn.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\nvmedisk.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Media\chimes.wav C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\system.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Discovery.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Runtime.Serialization.Formatters.Soap.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\managePermissions.aspx.it.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Globalization\Sorting\SortServer2008Compat.nls C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\arcsas.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UninstallPersistSqlState.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.DeveloperLicense.Commands.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.Windows.DeveloperLicense.Commands.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Network

Files

C:\Program Files\7-Zip\7-zip32.dll

MD5 dbc68c12931595581000fae594c4da65
SHA1 ff667e425973f4eaab53d9476a438dd3a021e972
SHA256 f0d1a2bab1e86df296024f6e9206de2537d23fd800fcfcc9bbcc5e72068c15a1
SHA512 6fa7578a1ec089844c8f755fa794613ed2ec925afb4ba4058d335badb43781821876b71318a251f3ce798976d0320ac2e5d202ae9ae344b339933a15c376c7c6

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 607fc36e2dc98388c07a5b80f14b3e0d
SHA1 0085f8d5f091e5a7fddfde88642f45391972f52b
SHA256 3a1bd0435f525aff049ec5e87528f34a713fb6da9d4ec083ed6da1b619101fc6
SHA512 90f6b2b2e3f38a23f6d20fdd40fb80830d39dfb472b3ef7f0fc0d47be79cdeaa0988d78f581f32d8c1a4186ff83d2e90f4b6454af4520a88cf29a3a9d9a48db7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 b957cdf1c45809990a2067ffb60af5d3
SHA1 8d1389e2ef7a762f237d9e0a9c82bc696fd75f14
SHA256 a8c50d7a6ef5a74f21237e3cc2f4eba17942cd32a30b2607937525d6975e1d46
SHA512 71e9400a4de1142097607ab27b6b722b67a2ea167dfab74f95a9044b7c70ec6fb254644a5fb46362051c79d5eebee05ad2d1e7b22902126b8e2ccdb016992814

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-03 14:59

Reported

2025-05-03 15:02

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (51) files with added filename extension

ransomware

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\Appx.format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AddressParser.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\IBSProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\F12\pdm.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC\IMTCCFG.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setup.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDHU1.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDTAJIK.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\LaunchWinApp.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\MSFT_FileDirectoryConfiguration.Registration.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\FolderProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Nui\FaceAnalysisColor.mdl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\RpcRtRemote.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.Devices.Portable.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\C_IS2022.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\MSFT_MetaConfigurationExtensionClasses.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\de-DE\GenericProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\fr-FR\WimProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\DragDropExperienceCommon.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\001a\_setup.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Keywords\ti_dnn_de-DE.table C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BthTelemetry.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\de-license.rtf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prncnfg.vbs C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\AppLocker.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\AssignedAccessMsg.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\MSFT_MetaConfigurationExtensionClasses.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\en-US\IBSProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\en-US\LogProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDSYR1.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\LicensingWinRT.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WSTPager.ax C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCache.types.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\AudioEng.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\FXSCOM.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDBGPH1.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Speech_OneCore\Common\es-ES\Tokens_SR_es-ES-N.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\TtlsExt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WEB.rs C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\@WirelessDisplayToast.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\MSFT_FileDirectoryConfiguration.Schema.mfl C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\OSProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\de-DE\IntlProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDPO.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\KBDSF.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\NcaApi.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\TempSignedLicenseExchangeTask.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\BCP47Langs.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\fr-FR\FolderProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\it-IT\LogProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\NlsData0022.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\PortableDeviceTypes.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Windows.System.SystemManagement.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\Microsoft.AppV.AppVClientPowerShell.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCache.format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\ByteCodeGenerator.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\MSFT_DSCMetaConfiguration.mof C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\SysWOW64\Dism\AssocProvider.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_CarReservation.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_DogNose.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.PostalAddress.model C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-lightunplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_32x32x32.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\plugin.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosStoreLogo.contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-focus_32.svg C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_mobile_download_v1.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\resources.pak C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\WideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Cursors\aero_link_im.cur C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netxex64.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\system.data.sqlxml.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.Numerics.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Cursors\pin.svg C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.ja.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\UninstallCommon.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsLexicons000a.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Data.Linq.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\fr\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.IO.Compression.FileSystem.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\lsi_sas.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.rsp C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Boot\BootDebuggerFiles.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\netmlx5.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\fr\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXmlLinq.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\System.Management.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regbrowsers.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\aspnet_regbrowsers.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\ja-JP\RPC.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\SMSvcHost 4.0.0.0\_SMSvcHostPerfCounters.ini C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\Gaming.png C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100fra_x86 C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceProcess.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\aspnet_regbrowsers.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.de.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\WsatConfig.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\bahnschrift.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Fonts\verdanai.ttf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\percsas2i.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\MME.browser C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\setUpAuthentication.aspx.resx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Log.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Web.Routing.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\de\Tracking_Logic.sql C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Configuration.Install.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\Regasm.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cscomp.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\WsatConfig.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\XamlBuildTask.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\it-IT\StorageHealth.adml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Prefetch\RUNDLL32.EXE-FCAF5656.pf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\es\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config.comments C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Activities.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.KeyDistributionService.Cmdlets.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.Resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.Web.Extensions.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PLA\Rules\Rules.System.Configuration.xml C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\PolicyDefinitions\PerformancePerftrack.admx C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Eva.NNM C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\mdmmhrtz.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\INF\pmem.inf C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\Microsoft.VisualBasic.Activities.CompilerUI.dll C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe N/A

Browser Information Discovery

discovery

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-03_b312be4969f3de211b46bb28fefc55bb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 c.pki.goog udp
DE 142.250.184.195:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7-zip.dll

MD5 dee4ba2da2b1333ffee0461dcb348aa4
SHA1 174940d2c05340c59a391fee4d62bfab92a02e85
SHA256 b426f355e37f13b18f515264477f7fd567d9f31aa5c2104c0231abc7a2e1ad38
SHA512 d74db3e9c3a22c2d3175eb59b533d27928635337d83f5ef56d825b4a7cdacab2546b90d2cd11b2b352af6397ae2e3286968a2d358095dcd33352a14bb4e9e822

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 822d43105baeeb4b979a770940d0bd1d
SHA1 8d09378e50a8a57ea22bae90ee572407ba803922
SHA256 89c074a034c3462b56d37df97654e43e8da233b92f69c6585c0a33e09a771393
SHA512 f017ae96e536393575e299b3e429bba557065ef114cb9537f9f8143b06ed151ed35de6fe827b8a223a9194aa0ce498bc5e316064188bc2592043c87bd76a4809

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 dd9f2baa7c5046de065763219b947a90
SHA1 b1cd22ef38b42a2f17d0e4d95f97ff2bc3d233ec
SHA256 aff7d11e6e0a8dd36dbdb0f351641bcb8d8282256b0f9f3e1802af3739be601a
SHA512 6135d4f8149afedbc0a73138622f5e853923534f1c06e50a6ad2cac0f059b672c18e36632d79f36d565569bd56969cf8b5ff42590ad22029fdea0b63dce936c7